Symantec found evidence linking a recent campaign of cyber attacks on the energy sector in Europe and the U.S. to a group called Dragonfly, which was first seen in 2011. This "Dragonfly 2.0" campaign appears to have begun in 2015, with an increase in activity seen since the beginning of 2017. Read more about this group in Symantec Security Response's blogs: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group Dragonfly 1.0: https://www.symantec.com/connect/blogs/dragonfly-western-energy-companies-under-sabotage-threat-energetic-bear

1. Title
Presenter Date
Dragonfly 2.0
Attacks Against the Western Energy
Sector

2. 2Copyright © 2017 Symantec Corporation
o Symantec research reveals ongoing
campaign against the energy sector
o Majority of targeted organizations are in the
US and Turkey, with possible infections in
other countries
o Primary motive is intelligence-gathering
o Intelligence gathered may enable future
sabotage attacks
Dragonfly 2.0

3. 3Copyright © 2017 Symantec Corporation
o Dragonfly group first profiled by Symantec in 2014
o Also known as Energetic Bear
o Research revealed cyber espionage campaign targeting energy
sector from as early as 2011
o Breached organizations using watering-hole websites and trojanized
ICS software
History of Dragonfly

4. 4Copyright © 2017 Symantec Corporation
o Resurgence of energy attacks
beginning late 2015
o Ramping up of activity during 2017
o Recent campaign shares tools and
techniques with earlier Dragonfly
activity
Dragonfly 2.0

5. 5Copyright © 2017 Symantec Corporation
Dragonfly 2.0 - Infiltration
Spear-phishing Emails Watering-hole websites Trojanized software
• Earliest emails
disguised as party
invites
• Later campaigns used
energy-related content
and some generic
content
• Attackers used
Phishery toolkit
• Toolkit uses template
injection method to
steal network
credentials
• Attackers compromised
websites likely visited
by those in energy
sector
• Some evidence that
watering hole websites
used fake Flash
updates to install
malware
• Shelter evasion
framework used to
develop trojanized
applications
• Backdoor programs
installed using
trojanized versions of
Windows apps

6. 6Copyright © 2017 Symantec Corporation
o Dragonfly uses a mixture of custom and generally available tools
o Backdoor.Dorshell
o Trojan.Karagany.B
o Trojan.Heriplor
o Trojan.Listrix
o Trojan.Credrix
o Backdoor.Goodor
o Phishery
o Screenutil
o Tools are primarily used for credential theft and screen capturing
o Also use living off the land techniques, e.g. PowerShell
Dragonfly 2.0 - Toolset

7. 7Copyright © 2017 Symantec Corporation
Feature Dragonfly 1.0 Dragonfly 2.0 Link strength
Backdoor.Oldrea Yes No None
Trojan.Heriplor (Oldrea stage II) Yes Yes Strong
Trojan.Karagany Yes Yes (Trojan.Karagany.B) Medium-Strong
Trojan.Listrix (Karagany stage II) Yes Yes Medium-Strong
“Western” energy sector targeted Yes Yes Medium
Strategic website compromises Yes Yes Weak
Phishing emails Yes Yes Weak
Trojanized applications Yes Yes Weak
Dragonfly 1.0 and 2.0 Links

8. 8Copyright © 2017 Symantec Corporation
o Harvesting credentials from targeted
organizations with the likely aim of
maintaining access
o Screenshots to acquire understanding of
operational activities
Dragonfly 2.0 - Motives
o Stolen credentials could facilitate future
disruptive activities
o Some evidence that operational systems
have been breached
o Screenshot filenames from target machines
include the string “cntrl” (control)
Intelligence gathering Sabotage

9. 9Copyright © 2017 Symantec Corporation
o Unclear at this time
o Evidence of some sophistication
o Scale of campaign
o Availability of custom tools
o But…possible lack of resources or attempts at misattribution
o No zero days
o Use of living off the land techniques and generally available tools
o Mixture of French and Russian language strings
Who’s behind Dragonfly?

10. 10Copyright © 2017 Symantec Corporation
o Symantec customers are protected against Dragonfly activity
o Tools specifically detected as:
o Trojan.Phisherly
o Backdoor.Goodor
o Trojan.Karagany.B
o Backdoor.Dorshel
o Trojan.Heriplor
o Trojan.Listrix
o Trojan.Karagany
Protection

11. 11Copyright © 2017 Symantec Corporation 11Copyright © 2017 Symantec Corporation
Thank you